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Objective and recommendation 


For the Executive Team to agree the approach to the annual report 
for 2021/22. 


The recommendation is that we repeat the process and format that 
was successful last year. 


Developing a common understanding 


Under the DPA 2018, the ICO is required to produce an annual 
report and accounts, which must be presented to Parliament before 
31 August each year. The annual report is therefore split into three 
parts: 

e Part A: Performance Report 

e Part B: Accountability Report 

e Part C: Financial Statements 


The 2021/22 annual report will need to be laid before Parliament’s 
summer recess in July 2022, likely to be on or around 21 July. 
This is reflected by the scheduling of the Audit & Risk Committee 
meeting on 20 June 2022, at which the Committee will expect to 
be presented with the final version of the annual report, which has 
been signed off by the external auditor. The Audit & Risk 
Committee will then advise the Commissioner to sign the annual 
report. 


It is recognised that at the time of publication of the annual report 
there will be a new Commissioner in role. They will be therefore 
reporting on the time leading up to the end of term for Elizabeth 
Denham as well as the start of their own term and the 
achievements of both Commissioners. We will need to ensure that 
this is reflected in the report. 
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Matters to consider to achieve objectives 


Part A performance report 


Overall performance narrative 


Prior to 2018/19 the annual report was structured around progress 
towards achieving the IRSP goals. However, the 2019/20 and 
2020/21 reports were structured around the Corporate Narrative 
and included supporting the public; enabling innovation and 
economic growth; raising global data protection standards; taking 
regulatory action; supporting the public sector; delivering the ICO 
service experience. 


This approach allowed us to rely on existing published comms 
products as the basis for the annual report. Comms also held the 
pen on writing the narrative which meant there was a more 
cohesive tone throughout the report. This was an efficient and 
successful approach. We recommend taking this approach again 
for this year’s annual report. 


Alternative options are: 


Structure the report around the IRSP; not recommended 
because at the time of publication of the annual report, we 
hope to have published a revised ICO Plan. 


Structure the report around the new ICO Plan; not 
recommended as the plan is still being developed it will 
therefore be challenging to create the content that speaks 
directly to the Plan. However, there will be some alignment 
between the Plan and the Corporate Narrative. 


Structure the report around the Management Board KPIs; not 
recommended as these are currently being developed. In 
addition, the nature of our work means that some areas of 
key activity are not necessarily fully covered by the KPIs. 
There will therefore not be the flexibility to share the 
narrative to these areas. However, KPIs will be reflected in 
the recommended corporate narrative approach. 


Defer the decision until John Edwards is in post to allow him 
to input his views on the approach that should be taken. 


Casework & KPIs 


The ICO’s casework is currently referred to in the annual report 
alongside other work, along with a statistical annex which sets out 
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the caseload figures for the year, compared to the two years prior 
to that. 


It is a requirement of annual reporting to include performance 
figures. However the detail we give of casework figures may be 
unnecessary and could be cut back slightly. With the development 
with the Management Board KPIs it is recommended that we 
broaden this section of the report to give statistical information of 
performance throughout the ICO rather than being limited to 
casework. 


We may want to consider moving this section to the start of the 
performance narrative so that it sets the scene for the narrative. 
We can however defer a decision on this to a later date and review 
the position of this section within the report in April 2022. 


Part B Accountability Report 


This section of the report includes the director's report, governance 
statement and remuneration policy. For each of these areas we 
are reporting in a standard format so there is little scope to amend 
or adjust what we report. 


We used the employee wellbeing section last year to provide 

information of the wellbeing work we have done to support staff 
during the COVID-19 pandemic. We can repeat this format this 
year and also use it to reflect on our work to return to the office. 


For the EDI part of this section, last year we expanded the section 
to give more information of the work we had done to achieve the 
EDI objectives. Management Board also agreed specific EDI 
targets and we can use this section of the report to reflect on 
progress to achieving them. We can add the EDI targets to this 
section of the report. 


Part C Financial Statements 


Although the financial statements are a key part of the annual 
report, there is not significant option for deviation from the norm 
on production of these. A report was submitted to the Audit 
Committee in October 2021 setting out the lessons learned from 
production of the 2020/21 annual report, including actions to be 
implemented to prevent these issues arising again. These will be 
implemented for the production of this report. 


The key issue with delivery of this part of the report this year is the 
turnover in personnel involved. We have a new company 
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providing external audit (Deloitte), a new Director of Finance and 
Head of Finance, new Independent Audit Committee Member and a 
new Commissioner. We have already started the process of 
building strong working relationships between all these parties but 
this will be a key area that we will need to monitor closely. 


There was discussion recently relating to whether we should 
produce a Trust Statement however the Audit & Risk Committee 
have agreed not to include a Trust Statement in the Annual Report. 


Other Potential Enhancements 


In November the Risk & Governance Board considered a report 
which set out some potential areas of best practice from the annual 
reports of other regulators, mainly relating to presentation in Part 
B and Part C. The recommendations for potential inclusion in our 
Annual Report included:- 


e Clearly setting out where our money has been spent 
regarding regulatory activity. This will give a clear indication 
to our fee payers of how the money has been spent to 
support our work and will enable us to better demonstrate 
value for money and how we utilise our income to support 
businesses. 


e An efficiency report which summarises all the different 
approaches taken to enhance efficiencies, such as cost 
savings, Organisation design, systems and IT infrastructure, . 
This will provide a clear narrative on efficiencies and how we 
deliver value for money for fee payers. 


e A comprehensive list of risks which have been considered by 
the board, including setting out risks in terms of “what we 
have done in the year to address the risk” and aligning risks 
to its objectives showing mitigations and the direction of 
travel/trend. 


e Setting out the key issues the Board has considered in the 
year. 


e Overview of the sector, to help to set the context for our 
regulatory activities and the importance of the work we 
undertake. 


Louise Byers and Angela Donaldson have taken an action to 
implement these as far as possible in this years’ Annual Report. 


Next steps 
4.1. The next steps for this work are: 


e Comms to develop first draft of performance narrative during 
March 2022. 


e Communications & Engagement Board and Executive Team to 
review draft during April 2022. 


e Submit Part A of the report to Management Board in May 2022 
e Finalise financial statements during June 2022 


e Audit & Risk Committee to consider Annual Report for sign off 
on 20 June 2022. 


e Target laying date of 11 July 2022. 


Author: Caroline Robinson 


Consultees: Chris Braithwaite, Louise Byers, Joanne Butler, Angela 
Donaldson and Dave Murphy 


Publication consideration: 
° Report can be published internally and externally without redactions. 


Outcome reached: 


